Full Report
Sality’s peer-to-peer infrastructure allowed it to evade system-wide disruption efforts for an exceptionally long period. Authorities and cybersecurity experts finally brought it down. The post Dogged Russia-based botnet dismantled after 23-year run appeared first on CyberScoop.
Analysis Summary
# Morning News Roll-up September 2, 2026
## Overview
Global law enforcement and cybersecurity firms have successfully dismantled Sality, one of the longest-running and most resilient peer-to-peer (P2P) botnets in history. Additionally, major actions were taken against Chinese espionage infrastructure and the leadership of the "Scattered Spider" hacking group.
## Top Stories
### Dogged Russia-based botnet dismantled after 23-year run
- Summary: Law enforcement agencies (FBI, DOJ, Europol) and CrowdStrike dismantled the Sality botnet, which operated for over two decades. By exploiting its P2P architecture, defenders tricked the network into cutting off infected devices, rendering the infrastructure irrecoverable.
- Source: hxxps://cyberscoop[.]com/sality-botnet-dismantled/
### Officials disrupt Chinese espionage operation hitting federal agencies
- Summary: Authorities seized a full hacking suite and infrastructure used by a Chinese government-funded group (QTFY). The group had successfully maintained undetected access to sensitive federal networks for over eight years.
- Source: hxxps://cyberscoop[.]com/qtfy-china-espionage-group-infrastructure-seized/
### Leading members of Scattered Spider sentenced in UK
- Summary: Key figures of the notorious "Scattered Spider" group received 66-month prison sentences in the United Kingdom. The group is well-known for sophisticated social engineering and high-profile ransomware attacks.
- Source: hxxps://cyberscoop[.]com/scattered-spider-leaders-sentenced-united-kingdom/
---
# Sality Botnet Dismantlement
A massive international operation has permanently disabled the Sality botnet, a Russia-based operation that infected over 11 million devices globally since its inception approximately 23 years ago.
## Key Points
- **Resilience:** Sality survived for two decades due to its decentralized, peer-to-peer (P2P) architecture, which lacked a central command-and-control (C2) server.
- **Takedown Strategy:** CrowdStrike and authorities targeted the "peer list" on infected machines, poisoning the network to trick devices into permanently disconnecting from the botnet.
- **Scale:** The botnet infected more than 11 million devices over its lifespan.
- **Collaboration:** The effort involved the FBI, DOJ, Europol, and authorities from Bulgaria, Hungary, and Romania, alongside the Shadowserver Foundation and CrowdStrike.
## Threat Actors
- **Origin:** Russia-based.
- **Motivation:** Primarily financial (cryptocurrency theft), but also capable of politically motivated actions.
- **Attribution:** While specific individuals were not named in the report, the operator has been active since roughly 2003.
## TTPs
- **P2P Communication:** Infected machines communicated directly with one another to receive instructions and updates, bypassing traditional server-based disruptions.
- **Malware Distribution:** Used as a delivery mechanism for various malicious payloads.
- **DDoS Attacks:** The infrastructure was utilized for at least three documented Distributed Denial of Service (DDoS) attacks.
- **Cryptocurrency Theft:** Used to steal digital assets from infected victims.
## Affected Systems
- **Scope:** Over 11 million infected devices worldwide.
- **Geography:** Extensive impact in the United States and international locations.
- **Infrastructure:** General consumer and enterprise computing devices were turned into "bots" within the network.
## Mitigations
- **Identification:** The Shadowserver Foundation is collaborating with Internet Service Providers (ISPs) to identify IP addresses associated with infected devices.
- **Remediation:** Victims are encouraged to work with ISPs for device cleaning; however, the recent takedown has rendered the botnet's infrastructure "irrecoverable."
- **Endpoint Protection:** Deployment of modern EDR/AV solutions (like CrowdStrike) to detect and block Sality malware signatures.
## Conclusion
The dismantling of Sality marks a significant milestone in cyber law enforcement, proving that even highly resilient P2P botnets can be defeated through coordinated technical infrastructure poisoning. Organizations should remain vigilant as the Shadowserver Foundation continues to notify victims through ISPs to ensure remnant malware is removed from affected endpoints.